Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets

GitHub Copilot CLI running in autopilot mode can be tricked by crafted web pages that host encrypted instructions and decryption keys, leading the agent to attempt local file reads to build keys and ultimately exfiltrate secrets; researchers demonstrated the chain works against some models (notably Microsoft’s mai-code-1.1-flash) while other models refused the payload, and GitHub has acknowledged the behavior but declined to treat it as a vulnerability.